Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-68554Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests

Low 2.3

In plain English

A low-severity insufficient verification of data authenticity in coturn from coturn. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.2%top 91.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMAC remains valid because it covers only the message prefix. Server-side parsing in src/server/ns_turn_server.c continues past MESSAGE-INTEGRITY through handle_turn_allocate(), handle_turn_create_permission(), handle_turn_refresh(), and handle_turn_command(), allowing trailing LIFETIME, XOR-PEER-ADDRESS, or ORIGIN attributes to override allocation lifetime, inject a permission, or bypass the origin check. TLS and DTLS deployments prevent this in-transit modification. This issue is fixed in version 4.15.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	coturn	no fix listed	DEBIAN-CVE-2026-68554
Debian:13	coturn	no fix listed	DEBIAN-CVE-2026-68554
Debian:14	coturn	4.15.0-1	DEBIAN-CVE-2026-68554
Ubuntu:22.04:LTS	coturn	no fix listed	UBUNTU-CVE-2026-68554
Ubuntu:24.04:LTS	coturn	no fix listed	UBUNTU-CVE-2026-68554
Ubuntu:26.04:LTS	coturn	no fix listed	UBUNTU-CVE-2026-68554
Ubuntu:26.10	coturn	no fix listed	UBUNTU-CVE-2026-68554

Affected products (as reported)

Vendor	Product	Versions
coturn	coturn	< 4.15.0

Weakness: CWE-345, CWE-924 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/coturn/coturn/security/advisories/GHSA-5538-7cxj-5jcc x_refsource_CONFIRM
https://github.com/coturn/coturn/commit/ab762f334f511ea37ab4b703a47d5d683a5be978 x_refsource_MISC
https://github.com/coturn/coturn/releases/tag/4.15.0 x_refsource_MISC